Lylac Logolylac

Privacy Policy

Last updated: 9 October 2026

1. Who we are

CYBERGLASS Pty Ltd (ABN 76 682 310 023), trading as Lylac ("CYBERGLASS", "we", "us", "our"), develops and operates the Lylac event-management platform ("Lylac", the "Platform").

2. Purpose of this policy

We handle personal information in a manner consistent with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). This policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights.

3. What personal information we collect

We collect:

  • Account details - name, email address, profile picture, organisation membership, and role.
  • Session information - sign-in token, IP address, browser type.
  • Platform activity - events created or attended, activities favourited, polls answered, posts made in the "Moments" feature, leaderboard entries, and feedback submitted.
  • Assistant conversations - the messages you send to the Lylac AI assistant and the actions it proposes or performs at your request.
  • Billing information - we do not store your card details. Payments are collected and handled by our payment provider, Stripe. We keep limited information about your subscription and billing contact (such as a billing email and address) to manage your plan.
  • Ticket purchases - the tickets you buy, what you paid, and the payment reference. Your card details go directly to Stripe and we never see them.
  • Usage analytics - aggregated information about how the Platform is used (for example, pages viewed and buttons clicked).

We do not intentionally collect sensitive information (such as health data). If you choose to share such information in public posts, it will still be handled under this policy.

4. How we collect information

  • You provide it directly when signing up, creating organisations or events, or using interactive features.
  • Essential cookies or tokens keep you signed in and protect the service.
  • Analytics tools collect high-level usage data to help us improve the Platform.
  • Third-party identity providers supply profile details when you sign in via SSO.

5. Why we collect and use it

  • To verify your identity and let you access events and organisations.
  • To personalise your schedule, send event updates, and deliver invitation emails.
  • to provide the AI assistant, which reads event data within your organisation (event details, schedules, activities, speakers, attendee and invitation records) to answer your questions and carry out changes you approve;
  • To operate, secure, and improve the Platform.
  • To process payments and manage subscriptions.
  • To comply with Australian law.

We only use your information for these purposes or as otherwise permitted by the APPs.

6. Disclosure of personal information

We do not sell personal information. We may disclose it to:

  • Organisation administrators - for event administration and attendee management within your organisation.
  • Event organisers - when you buy a ticket, the organiser running the event receives your name, email address and order details to run the event and handle your ticket and any refund.
  • Stripe - ticket payments are processed by Stripe on the organiser's Stripe account, and organisers who sell tickets give details about themselves and their business to Stripe to be paid. When you provide personal data in connection with ticket payments or payouts, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.
  • Service providers that help us host the Platform, process payments, deliver emails, and detect or prevent abuse. We take reasonable steps to ensure these providers handle personal information in a manner consistent with this policy.
  • AI model providers - when you use the AI assistant, your messages and the event data needed to answer them are sent to Google Cloud (Vertex AI, Gemini models) to generate a response. Google does not use this data to train or improve its models, and may temporarily process and log requests for abuse monitoring under its terms.

All primary storage is located in Australia. Some processing happens overseas: AI assistant requests are processed by Google Cloud and may be handled outside Australia, including in the United States, error and performance monitoring data is processed in the European Union, and payment information is processed by Stripe, which may handle it outside Australia, including in the United States. We take reasonable steps to ensure overseas recipients handle personal information in a manner consistent with the Australian Privacy Principles.

7. AI features

The Platform includes an AI assistant that can answer questions about your events and, at your request, make changes such as creating events, activities, and speakers. It is clearly identified as an AI feature within the Platform.

  • What it can access - only data within the organisation you are working in, limited to what your role already allows you to see and do.
  • Human control - the assistant proposes changes and a person approves them before they are made. It does not make decisions about you or about attendees on its own.
  • Accuracy - responses are generated by a machine learning model and may be inaccurate or incomplete. Review them before relying on them or sharing them with others.
  • No model training - we do not use your data, or your attendees' data, to train or fine-tune any AI model, and our model provider does not either.
  • Retention - assistant conversations are kept with your account until you delete them from the assistant, or your account is deleted.
  • Choice - use of the assistant is optional. Organisation administrators who want it disabled for their organisation can contact us.

8. Data security

Keeping your personal information safe is something we take seriously. We protect it with technical and organisational safeguards we consider appropriate to the sensitivity of the data we hold. That said, no system can truly be guaranteed secure, and we cannot ensure that information you transmit to the Platform, or that we hold on your behalf, will not be accessed, disclosed, altered or destroyed.

9. Cookies and similar technologies

The Platform uses a small number of cookies and local-storage keys that are strictly necessary to:

  • keep you signed in,
  • protect the site from bots and abuse, and
  • remember your display preferences (e.g. dark or light mode).

We do not use advertising or cross-site tracking cookies. You can disable non-essential cookies in your browser, but essential cookies are required for the service to function.

10. Access and correction

You may ask us to:

  • provide a copy of the personal information we hold about you;
  • correct any information that is inaccurate, out-of-date, or incomplete;
  • delete your account.

We will verify your identity before actioning such requests. Contact details are below.

11. Automated decision-making

We do not use computer programs to make decisions, or to do things substantially and directly related to making decisions, that could reasonably be expected to significantly affect your rights or interests. The AI assistant only drafts and suggests; a person approves each change before it takes effect. If this changes, we will update this section to describe the kinds of personal information used by those programs and the kinds of decisions they make.

12. Data retention

  • Account and platform data - we retain personal information for as long as your account or organisation is active, and for as long after that as is necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.
  • Ticket orders - kept for as long as tax and financial record-keeping laws require. If you delete your account, the orders are kept without your name or email address.
  • Posts and content you create - remain until you delete them or ask us to remove them.
  • System logs and backups - retained for as long as needed for security, troubleshooting and disaster recovery, then deleted or overwritten in the ordinary course.

When we no longer need personal information, we take reasonable steps to delete or de-identify it.

13. Complaints & contact details

Privacy Officer - CYBERGLASS Pty Ltd
Email: privacy@cyberglass.com.au
Postal: Level 2, 45-47 Bourke Street, Melbourne VIC 3000, Australia

If you're unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

14. Changes to this policy

We may update this policy from time to time to reflect changes in law or our practices. When we do, we will post the updated version on this page and update the effective date. We will let users know about material changes through the Platform or by email.